Terraform-provider-aws: terraform continually detects changes aws_cloudformation_stack

[hashibot[bot]]

_This issue was originally opened by @KarlGrear as hashicorp/terraform#21130. It was migrated here as a result of the provider split. The original body of the issue is below._

---

Terraform v0.11.13

I am importing the existing cloud formation stack into the terraform.tfstate which reports success.
The import does not populate my stack parameters, and detects the template_body needs to change.
I then do a terraform plan, terraform apply.
I get a success.
I then do a terraform plan and the parameters are now up to date but the template_body still shows it needs to change.
I then do another apply and plan, same thing.

When I look at the cloudformation stack, the event log shows no changes have occurred.

docs.zip

[marcincuber]

I am noticing the same behaviour. For the same version of terraform.

[katsou55]

Hello, I have upgraded terraform and also the AWS provider from V1.5.x to V2.x. and I am experiencing this behavior since I am using the new provider.

[Szasza]

I have noticed this behaviour when I have created a stack successfully, and later realised that one of the stack parameters are unused.

When I removed the parameter Terraform detected changes (correctly) but upon applying the changes there was no change in the stack, Terraform also reported success, but the parameter stayed as-is when observing the stack via the AWS console.

After the above, if I manually uploaded the CloudFormation template via the AWS Console, the removal of the parameter was correctly detected by AWS, the stack got updated, and Terraform did not flag the changed template body any more.

[tduffield]

I saw this as well, and at least for my case I tracked it down to how AWS handles template_body.

Terraform hands AWS everything we give it. It does no pre-processing to detect change. It simply sends what we have straight to AWS. So there is little that can be done in this provider to address the issue.

What I believe is happening is AWS is processing the template_body we give it and determining if it needs to make any changes to resources it manages. If it determines that there are no changes needing to be made (even if the contents of template_body have changed), then it returns a known error message back to Terraform which basically says "there are no changes I need to make." It then drops the new template_body on the floor, even if the contents of the new request are different than the one it currently has.

So, if we make a change to the template_body that does not impact the state of the stack, AWS simply ignores the update and tells Terraform "there are no changes to be made." And, as far as I can tell, there is no API for simply updating the template body.

[tlangh15]

We're still seeing this issue with 12.18 showing template_body change but then there are no changes shown in the plan output within template_body. I have sometimes been able to make a irrelevant change in the body (i.e. Parameter description) and then change it back and it will detect no changes after applying, reverting the change, and applying again but that even seems to work sporadically. We're using the file method to load the template_body from a file (i.e. file("windows_ec2_template.yml")).

This is causing a lot of frustration as we're launching 5-10 CFN stacks in single terraform project and they are all showing template_body changes (with no actual changes) which makes it hard to decipher what's going on as each template_body is 1000+ lines.

[jacopomaroli]

I'm experiencing the same issue (changes detected even though there aren't). I think @tduffield is on the right path when he says

AWS is processing the template_body we give it

because as a workaround for the issue I copy pasted from the AWS console the processed template into a file and passed that to template_body as in
resource "aws_cloudformation_stack" "foobar" { name = "foobar" #template_body = file("foobar.yml") template_body = file("foobar_processed.json") # workaround because of https://github.com/terraform-providers/terraform-provider-aws/issues/8465 }
(notice yml/json difference, that's also the thing which set me on the right path in first place)
It's not the best but at least it's not tripping the diff every time I run terraform

Looks like local template when submitted should be tested against remote Original rather than remote Processed(?)

[bflad]

Hi folks 👋 There is likely a relevant fix for this which was just merged: https://github.com/terraform-providers/terraform-provider-aws/pull/9006

That change submits the TemplateState parameter with value Original (what should've been the default, according to the CloudFormation API Reference, but seems like it was not in some cases). This change will release with version 2.44.0 of the Terraform AWS Provider, next Thursday.

I'm going to optimistically close this issue since the fix should cover at least some of the reports in this issue. If you are still having trouble even after upgrading to version 2.44.0 when it is released next week, please submit a new bug report and we will take a fresh look. Thanks.

[jgardsentry]

Thank you @bflad . Do you know if this will also address the issue in the original request "The import does not populate my stack parameters"? I'm seeing the same behavior on 2.34.0

[hashibot[bot]]

This has been released in version 2.44.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!